synoti logosynoti logo
Antivirus ESMC / ESET

Detection rules for ESMC / ESET Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 13 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Advanced Heuristic Detection TriggersDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2
ESET Agent Disabled or TamperedDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:3
ESET Blocked Suspicious PowerShell ActivityExecutionT1059.001 - Command and Scripting Interpreter: PowerShellC:3 / I:3 / A:1
ESET Botnet Communication DetectionCommand and ControlT1071 - Application Layer ProtocolC:3 / I:3 / A:2
ESET ERA/ESMC Console Suspicious ActivityLateral MovementT1072 - Software Deployment ToolsC:3 / I:3 / A:2
ESET Exploit Detection AlertPrivilege EscalationT1068 - Exploitation for Privilege EscalationC:3 / I:3 / A:2
ESET Host Intrusion Prevention System TriggeredDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2
ESET Network Attack DetectionInitial AccessT1190 - Exploit Public-Facing ApplicationC:3 / I:2 / A:1
ESET Repeated Quarantine FailuresDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:2 / I:3 / A:2
Machine Learning Detection AnomaliesExecutionT1204.002 - User Execution: Malicious FileC:3 / I:3 / A:2
Registry Modification Attempts BlockedDefense Evasion, PersistenceT1112 - Modify RegistryC:2 / I:3 / A:2
Suspicious Encrypted File ActivityImpactT1486 - Data Encrypted for ImpactC:3 / I:3 / A:2
Suspicious Process Behavior DetectionDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2

Rule Example

Below is an example of a rule definition for Advanced Heuristic Detection Triggers (view in repository):

# Rule version v1.0.0

dataTypes:
  - antivirus-esmc-eset
name: Advanced Heuristic Detection Triggers
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Defense Evasion, Privilege Escalation
technique: "T1055 - Process Injection"
adversary: origin
references:
  - https://help.eset.com/eea/8/en-US/idh_config_threat_sense.html
  - https://attack.mitre.org/techniques/T1055/
description: |
  Detects when ESET's advanced heuristic engine identifies suspicious behavior patterns that may indicate novel malware or zero-day threats. These detections use DNA signatures and behavioral analysis.
  
  Next Steps:
  - Review the affected hostname and user context to understand the scope
  - Check the process name (if available) that triggered the detection
  - Verify if the action taken (cleaned/deleted/quarantined) was successful
  - Look for related alerts from the same host within the past 24 hours
  - If multiple hosts show similar detections, investigate potential lateral movement
  - Consider isolating the affected system if threat persists
  - Review ESET console link (if available) for detailed threat information
  - Check file hash against threat intelligence databases if available
  - Capture and analyze the malicious file sample if quarantined
  - Review system logs for any unusual activities before and after detection
  - Update ESET signatures and run a full system scan
where: |
  oneOf("log.msgType", ["EnterpriseInspectorAlert_Event", "threat_event", "FirewallAggregatedAlert_Event"]) &&
  contains("log.jsonMessage", ["heuristic", "NewHeur", "suspicious behavior"]) &&
  contains("log.jsonMessage", ["cleaned", "deleted", "quarantined", "blocked"])
afterEvents:
  - indexPattern: v1-7-22-log-antivirus-esmc-eset-*
    with:
      - field: log.headHostname
        operator: filter_term
        value: '{{.log.headHostname}}'
    within: now-30m
    count: 3
groupBy:
  - lastEvent.log.headHostname
  - lastEvent.log.msgType

Rule Details

Advanced Heuristic Detection Triggers

Triggers when the ESET advanced heuristic engine finds suspicious behavior patterns that could point to new malware or zero-day threats. Such detections rely on DNA signatures and behavioral analysis.

ESET Agent Disabled or Tampered

Triggers when the ESET security agent is disabled, removed, or altered. This serves as a key defense evasion indicator because attackers often turn off endpoint protection before running their payload.

ESET Blocked Suspicious PowerShell Activity

Triggers when ESET blocks suspicious PowerShell commands or scripts that show malicious behavior patterns, such as obfuscated scripts, encoded commands, or efforts to bypass execution policies. This is a high-priority security event showing that potential malicious activity was stopped.

ESET Botnet Communication Detection

Triggers on attempts to communicate with known botnet command and control servers. ESET recognizes typical communication patterns when a computer is infected and a bot is trying to reach malicious C2 infrastructure.

ESET ERA/ESMC Console Suspicious Activity

Triggers on suspicious activity in the ESET ERA/ESMC management console, such as unauthorized policy changes, broad task deployments, or admin account changes that may signal console compromise.

ESET Exploit Detection Alert

Triggers when the ESET Exploit Blocker identifies and blocks exploitation attempts aimed at vulnerabilities in frequently exploited applications like browsers, document readers, email clients, Flash, and Java.

ESET Host Intrusion Prevention System Triggered

Triggers when the ESET Host-based Intrusion Prevention System (HIPS) blocks suspicious behavior, such as process manipulation, registry modifications, and file system changes that point to possible malware activity. HIPS events signal active attempts to compromise system integrity through various attack techniques.

ESET Network Attack Detection

Triggers on network-based attacks and exploits blocked by the ESET Network Attack Protection (IDS). This covers attempts to exploit known vulnerabilities in network services and protocols.

ESET Repeated Quarantine Failures

Triggers on repeated quarantine failures in ESET, which can indicate malware actively resisting quarantine via file locks, permission changes, or quick re-creation of malicious files.

Machine Learning Detection Anomalies

Identifies threats found by the ESET machine learning engine, which analyzes file behavior patterns and characteristics to detect previously unknown malware variants. Machine learning detection points to advanced malware that may avoid signature-based detection methods.

Registry Modification Attempts Blocked

Identifies attempts to change critical Windows registry keys that ESET blocked, signaling possible persistence or system tampering efforts. Registry modifications are a common malware technique used to establish persistence, disable security features, or alter system behavior.

Suspicious Encrypted File Activity

Triggers on suspicious encrypted file activities that may point to ransomware encryption attempts or unauthorized file encryption operations. This rule fires when ESET detects ransomware-related threats or file encryption activities.

Suspicious Process Behavior Detection

Triggers on suspicious process behaviors, such as injection attempts, privilege escalation, and unusual process creation patterns found by ESET behavioral monitoring. This alert points to possible malware activity or exploitation attempts on the affected system.